Splunk Enterprise

Metric rollup

brandy81
Path Finder

Hi All,

I have a question about metric rollup.

https://docs.splunk.com/Documentation/Splunk/latest/Metrics/MRollupsOverview

As stated by the document, metric rollup is for saving storage. Saying there are source metric index(A) and target metric index(B). Then, how is it for saving storage? Origin data indexed in index(B) is rolled up into index(B), which means taking more storage. My question is this: do I have to delete source index(A) periodically? How to handle source index in metic rollup environment?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, yes. Once you have extracted the metric data from the raw events, you can delete the raw events. For example, the raw events might be useful for looking at current issues, but let's say after 3 months, the data is too old to be of any value for problem analysis. However, it might be useful to know how traffic flow has changed over the last 6 months or a year. You don't need the raw data for this, you just need some useful metrics from the data, e.g. hourly counts, hourly average response times, etc. So, you collect this metrics data and keep that while removing raw events older than 3 months.

0 Karma

brandy81
Path Finder

Hi @ITWhisperer Thank you for the answer. I meant that the source index(A) is the metric index, not the event index. I meant source(A)/destination(B) are metric indexes both. Is your answer still valid in this circumstance? Additionally, I have a question. How do I delete the source index? By setting shorter retention policy? I have never seen that the metric rollup is used in the real world...

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...